NSP network and user data privacy

Purpose

This appendix summarizes how the NSP treats private data that is collected, processed, or retained, such as:

user authentication data
NE data
subscriber data
e-mail notification policy data

See NSP data privacy or NFM-P data privacy for specific summary information.

NSP data privacy

The following table lists and describes, by category, how the NSP treats network and user data.

Table 8-1: NSP treatment of private data

Data category	Description and treatment
NE data
Type of data	Username and password IP address
Purpose	NE authentication NE IP address for NE discovery/access
Storage	Local database Logs
Retention	Data is retained in the database until an authorized user deletes it. Log retention can vary based on the log file size and number of log backups.
Processing	NE data is processed for the stated purpose.
Access	Authorized users
Safeguards	NEs are configured by authorized users. Database access is restricted to authorized users. Secure transit option is available. Passwords for NE users are encrypted before being stored. Log file access is restricted to authorized users.
Subscriber data
Type of data	MAC address IP address
Purpose	Statistics SLA support Troubleshooting
Storage	Local database Logs
Retention	Data is retained in the database until an authorized user deletes it. Log retention can vary based on the log file size and number of log backups. Retention period for statistics can be configured.
Processing	Subscriber data is processed for the stated purpose.
Access	Authorized users
Safeguards	NEs are configured by authorized users. Database access is restricted to authorized users. Log file access is restricted to authorized users.
E-mail notification policy data
Type of data	Username and password E-mail address (sender) E-mail address (recipient)
Purpose	Username, password and sender’s e-mail address are used for SMTP configuration Recipient e-mail addresses are required to create e-mail notification policies in supported functions
Storage	Local database
Retention	Data is retained in the database until an authorized user deletes it. By default, SMTP server and e-mail notification policies are not configured.
Processing	SMTP server configuration and e-mail notification policies are processed for the stated purpose.
Access	Authorized users
Safeguards	SMTP configuration and e-mail policies are configured by authorized users. Database access is restricted to authorized users. Password for SMTP configuration is encrypted before being stored.

NFM-P data privacy

The following table lists and describes, by category, how the NFM-P treats network and user data.

Table 8-2: NFM-P treatment of private data

Category	Description
Local user data (local authentication)
Type of data	Username and password E-mail IP address
Purpose	Authentication of local NSP users User e-mail addresses (optional) to send notifications for certain events; for example, alarms or account status IP address provides accountability of individual product access.
Storage	Local database Logs
Retention	Data is retained in the database until an authorized user deletes it. Log retention time can vary based on log file size and the number of log backups.
Processing	Local user data is processed for the stated purpose.
Access	Authorized users
Safeguards	Additional local users must be created by an authorized user. Database access is restricted to authorized users. TLS secures data in transit. Passwords for local users are hashed before they are stored. Log file access is restricted to authorized users.
Comments	Local authentication is performed using a local database of users and a local security scheme.
Customer profile data
Type of data	Name E-mail Address Phone
Purpose	Data may be used by an authorized user for associating customers to configured services.
Storage	Local database
Retention	Data is retained in the database until an authorized user deletes it.
Processing	Customer profile data is processed for the stated purpose.
Access	Authorized users
Safeguards	Customer profile must be created by an authorized user. Database access is restricted to authorized users.
NE data
Type of data	Username and password IP address
Purpose	NE authentication NE IP address for NE discovery/access
Storage	Local database Logs Note that NE backups that are stored on the NFM-P server may contain data that is not stored in the NFM-P database. Data contained in the NE backup files will be dependent upon the NE type and version; therefore the privacy statements for the individual NEs must be consulted.
Retention	Data is retained in the database until an authorized user deletes it. Log retention can vary based on the log file size and number of log backups.
Processing	NE data is processed for the stated purpose.
Access	Authorized users
Safeguards	NEs are configured by authorized users. Database access is restricted to authorized users. Secure transit option is available. Passwords for NE users are encrypted before being stored. Log file access is restricted to authorized users.
Subscriber data
Type of data	MAC address IP address International Mobile Subscriber Identity (IMSI) International Mobile Station Equipment Identity (IMEI) Mobile Station International Subscriber Directory Number (MSISDN) Access Point Name (APN)
Purpose	Statistics SLA support Troubleshooting Analytics UE or network node performance information
Storage	Main database NSP auxiliary database Logs Auxiliary servers (optional): statistics
Retention	Data is retained in the database until an authorized user deletes it. Log retention can vary based on the log file size and number of log backups. Retention period for auxiliary servers can be configured.
Processing	Subscriber data is processed for the stated purpose.
Access	Authorized users
Safeguards	NEs are configured by authorized users. Database access is restricted to authorized users. Secure transit option is available. File access is restricted to authorized users. Log file access is restricted to authorized users.
E mail notification policies
Type of data	Username and password E-mail address (sender) E-mail address (recipient)
Purpose	Username, password and sender’s e-mail address are used for SMTP configuration Recipient e-mail addresses are required to create e-mail notification policies in supported functions
Storage	Local database
Retention	Data is retained in the database until an authorized user deletes it. By default, SMTP server and e-mail notification policies are not configured.
Processing	SMTP server configuration and e-mail notification policies are processed for the stated purpose.
Access	Authorized users
Safeguards	SMTP configuration and e-mail policies are configured by authorized users. Database access is restricted to authorized users. Password for SMTP configuration is encrypted before being stored.